lundi 9 mars 2015

How can I make a public static class "secure"?

I'm looking to create a secure wrapper for a public class with public static methods, so let's say the class is very simply:



public class MyClass {
public static int Add (int first, int second)
{
return first + second;
}
}


I want to have a client needing to access this via some secure other class that will call MyClass. At the end of the day I'm expecting to have all this code in a single dll for clients to use. The intention is to have some behaviour like:



public class SecureMyClassWrapper
{
bool _isUnlocked;
private static readonly List<string> validIds = new List<string>(){"only me", "and them"};

public SecureMyClassWrapper(string id)
{
if (validIds.Contains(id))
{
_isUnlocked = true;
}
else
{
_isUnlocked = false;
}
}

public int Add(int first, int second)
{
if (_isUnlocked)
{
return MyClass.Add(first, second);
}
else
{
// throw security exception etc.
}
}
}


There's a fair possibility that someone with more hacking ability than me is going to want to get at my static methods, so please can somebody suggest why this might be a bad approach or what I should be concerned about here? Some ideas would be that



  • MyClass methods can easily be called through reflection

  • somebody could ildasm.exe code, change the list of validIds or _isUnlocked logic (or even their values at runtime?)

  • possible to read a valid ID and then use it as their own


How could I guard against reflection or decompilation in these cases? Is there a standard approach for this you would recommend, e.g. Code Access Security?






Aucun commentaire:

Enregistrer un commentaire